{
 "id": "WPSEC-2026-2789",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2789/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2789/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2789/index.md",
 "title": "Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts <= 2.7.10 - Reflected Cross-Site Scripting via 'order' and 'orderby' Parameters",
 "description": "The Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order' and 'orderby' parameters on the Snippets Library page in all versions up to, and including, 2.7.10, due to insufficient output escaping. The values are only passed through sanitize_text_field(), which does not remove double quotes, and are echoed into the value attributes of hidden form inputs in the snippets list table. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can successfully trick a logged-in administrator into performing an action such as clicking on a link.",
 "plugin": {
  "slug": "insert-php",
  "name": "Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts",
  "full_name": "Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts",
  "wordpress_org": "https://wordpress.org/plugins/insert-php/",
  "advisories_url": "https://wpsec.com/vuln/plugin/insert-php/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/insert-php"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.7.0",
    "from_inclusive": true,
    "to": "2.7.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.7.0 before 2.7.11"
  ]
 },
 "introduced_in": "2.7.0",
 "fixed_in": "2.7.11",
 "remediation": "Update to 2.7.11 or later.",
 "fix_released": "2026-11-09T09:30:52+00:00",
 "published": "2026-11-10T09:43:43+00:00",
 "updated": "2026-11-09T23:33:12.480572+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2789/",
  "https://plugins.svn.wordpress.org/insert-php/tags/2.7.11/",
  "https://wordpress.org/plugins/insert-php/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/insert-php",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-10"
 }
}